Developer Security
Focused developer security articles with clear context, practical examples, source links where needed, and honest limits.
31 articles in this section.
GitHub code scanning's Mitigated reason: when a vulnerability is not fixed
Use GitHub code scanning's Mitigated dismissal reason honestly when external controls reduce risk, while preserving remediation ownership and review evidence.
MCP allowlists in GitHub Copilot: a practical least-privilege setup
Use GitHub Copilot MCP allowlists to control remote and local servers, fail closed on bad settings, and review tool access before enterprise rollout.
GitHub Code Quality Actions path changed: update reports and cost tracking
Update GitHub Actions reports for the dedicated Code Quality workflow path and actor without losing code-scanning history, billing data, or audit visibility.
GitHub OAuth apps with multiple redirect URIs: secure migration guide
Configure GitHub OAuth apps with multiple callback URLs safely, preserve state validation, prevent redirect confusion, and migrate tokens without breaking users.
CodeQL 2.26.3 for JavaScript and GitHub Actions: what teams must retest
Review CodeQL 2.26.3 changes for JavaScript, TypeScript, Vue and GitHub Actions, including a breaking custom-query removal and updated taint models.
GitHub Actions malicious workflow approval: what maintainers should review
GitHub may hold suspicious public-repository workflows for approval. Learn what triggered runs can access, how to review the diff, and when approval is unsafe.
Dependabot malware alerts: enable them and triage a real package alert
GitHub expanded Dependabot malware data beyond npm. This guide shows how to enable malware alerts, verify exposure, contain a package, and avoid unsafe auto-fixes.
npm publish-time malware scanning: fix CI that expects instant installs
npm now scans packages before making them installable. Learn how to handle the normal publishing delay, verify registry availability, and keep release jobs reliable.
Secret scanning validators for Asana, IBM, and MessageBird credentials
GitHub expanded secret-scanning validators for Asana, IBM, and MessageBird credential types. Enable validity checks, map token owners, and rotate active secrets before cleaning history.
Secret scanning public monitoring for enterprises explained
GitHub announced public monitoring capabilities for enterprise secret scanning. Define verified domains and providers, route alerts to an incident queue, and establish external-repository contact procedures.
CodeQL Kotlin 2.4 support: upgrade static analysis with the language
CodeQL 2.26 supports Kotlin versions through 2.4.0. Update CodeQL alongside Kotlin, run a full baseline, and compare extracted files and alert counts.
CodeQL support for Go slog: prevent log injection and clear-text leaks
CodeQL 2.26 adds models for Go’s `log/slog` package to improve log-injection and clear-text-logging analysis. Use stable message templates, structured attributes, secret redaction, and output encoding.
CodeQL Razor Page request sources: catch C# injection paths
CodeQL 2.26 models `OnGet`, `OnPost`, and asynchronous handler parameters as remote-flow sources for C# analysis. Update scanning and review SQL, path, command, and template sinks reached from handler values.
CodeQL SSRF checks for IPv6 transition addresses
CodeQL 2.26 includes an experimental JavaScript query for incomplete IPv6-transition SSRF guards. Parse and normalize addresses with a maintained library, then enforce destination policy after DNS resolution.
Incremental CodeQL analysis: speed up CI without missing the full baseline
GitHub announced incremental analysis improvements for Go, C/C++, and CodeQL CLI workflows. Use incremental checks for fast feedback and schedule full analysis as the authoritative baseline.
Periodic code scanning for inactive repositories: find risk without alert overload
GitHub supports periodic code scanning of inactive repositories for eligible security programs. Target repositories by deployment and dependency risk, then route findings to a real owner.
Fetch GitHub Code Quality findings through REST without building a noisy dashboard
GitHub exposes Code Quality findings through REST for integrations and reporting. Import only findings tied to a clear workflow, deduplicate by stable identity, and sync resolution state.
Self-service credential revocation in GitHub incident response
GitHub added self-service credential revocation capabilities for supported enterprise incident workflows. Define who can revoke, how identity is verified, and how affected automation receives replacement credentials.
GitHub security API access restrictions: audit integrations before retirement
GitHub announced upcoming restrictions to public security API endpoints and related views. List every integration, owner, credential, endpoint, and fallback before enforcement.
GitHub closed security alert retention: export what compliance needs
GitHub announced an upcoming data-retention policy for closed security alerts. Identify audit requirements, export permitted records, and avoid storing sensitive alert details longer than necessary.
GitHub code coverage merge protection: prevent untested changes carefully
GitHub announced code coverage merge protection for pull requests. Baseline by repository, focus on changed code, and provide reviewed exceptions.
GitHub App token format changes: stop validating opaque tokens with regex
GitHub is rolling out a new installation-token format and recommends storage supporting at least 520 characters. Treat tokens as opaque, widen database columns, and test logs, proxies, and validators.
actions/checkout v7 blocks pwn requests: migration checklist
actions/checkout v7 refuses common unsafe fork checkout patterns and GitHub plans enforcement across supported majors. Replace privileged checkout-and-run workflows with unprivileged analysis or a reviewed two-stage design.
Control GitHub Actions workflow triggers with organization rulesets
Workflow execution protections add actor and event allowlists through GitHub rulesets. Run rules in evaluate mode, identify legitimate triggers, then block risky actors and events centrally.
Read-only GitHub Actions cache for untrusted triggers explained
GitHub now issues read-only cache tokens in default-branch contexts triggered by actors without write permission. Move cache population to trusted push or scheduled workflows and let untrusted runs restore only.
Restrict who can dismiss pull request reviews with GitHub rulesets
Control who may dismiss pull request reviews in GitHub rulesets, preserve emergency access, audit changes, and prevent approval bypasses.
GitHub secret scanning extended metadata and multipart validation explained
Use secret scanning ownership, expiry, project context, and multipart validation to prioritize leaked credentials and remediate faster.
GitHub innersource security advisories: private vulnerability workflow
Set up GitHub innersource security advisories for privately shared code, coordinated fixes, affected repositories, and controlled disclosure.
GitHub Code Quality organization targeting: a safe rollout plan
Roll out GitHub Code Quality at the organization level with repository targeting, baseline checks, ownership, and measurable adoption.
GitHub secret scanning detector names explained: patterns vs AI detection
Understand GitHub’s renamed secret scanning detector types, how pattern and AI detection differ, and how to triage each alert correctly.
CodeQL AI prompt injection detection: what the new query catches
Learn how CodeQL detects untrusted data flowing into AI system prompts, where the query helps, and what developers still need to review manually.